SB 690: what California's CIPA amendment changes

What SB 690 changes

SB 690 adds a new subdivision (d) to Section 637.2, CIPA's civil remedy provision. The operative sentence reads: "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." Enrolled bill text.

Three limits are built into that sentence. It covers only Section 638.51 claims. It covers only actions against private actors. It covers only conduct alleged to occur on a website, online application, or mobile application. A claim outside any of those limits is not addressed by the amendment.

Effective date and pending cases

The Assembly passed the final version on August 28, 2026, and the Senate concurred in those amendments 39 to 0 the same day. Bill status. Governor Newsom signed it on September 30, 2026, and it becomes operative January 1, 2027. Pillsbury.

Subdivision (d)(2) applies the limitation retroactively "to any pending claim in an action commenced within two years before the operative date." Firm analyses read that as pending actions filed on or after January 1, 2025. Proskauer. Actions filed earlier fall outside that window.

The retroactive provision may be contested. Skadden reports that plaintiffs' firms have signaled constitutional challenges to it. Skadden. The bill also has a severability clause, so the forward-looking limit is drafted to survive if a court strikes the retroactive part. Enrolled bill text, Section 2.

What SB 690 does not change

• Section 638.51 itself. The bill does not amend the prohibition on installing or using a pen register or trap-and-trace device without a court order. It changes who may sue. WilmerHale.
• Attorney General enforcement. The Attorney General can still bring Section 638.51 actions over website and app conduct. Enrolled bill text.
• Sections 631 and 632. Private plaintiffs keep their remedies for wiretapping and confidential-communication claims, including the statutory damages in Section 637.2(a). Covington.
• Other laws. The federal Wiretap Act, the VPPA, other states' statutes, and common-law and constitutional privacy theories are outside the bill. Proskauer.

The version that did not pass

Earlier drafts of SB 690 would have exempted the processing of personal information for a "commercial business purpose" from Sections 631, 632, and 638.51. That language was removed before final passage. WilmerHale.

Much of what was written about SB 690 in 2025 describes that broader draft. A source that mentions a commercial business purpose exception is describing a version that did not become law.

Why pen register claims were the target

Section 638.50 defines a pen register around dialing, routing, addressing, or signaling information, and excludes the contents of a communication. Section 638.50. Website pen register complaints typically alleged that a tracker collected an IP address or device identifier without a court order. Because the theory did not depend on contents, the same allegations could be repeated across many websites.

An Assembly committee report on the bill called the pen register statute "a poster child for abusive lawsuits." Proskauer. In his signing message, the Governor said the bill addresses only one category of CIPA claims and asked the Legislature to revisit other provisions next year. Covington.

Where website claims go next

Defense firms expect plaintiffs to shift toward Sections 631 and 632 and toward other statutes. Skadden. Those claims raise questions a pen register theory could avoid: whether the recipient obtained the contents of a communication, whether that happened in transit, whether the recipient was a party or an outside listener, and whether consent came first. The CIPA Section 631 explainer covers those elements.

That moves attention to specific facts. Did a request carry a typed search, a form field, a chat message, or a descriptive URL, or only an IP address and a page-view event? What did the consent notice say, and did tracking follow the visitor's choice? Those are questions about particular user journeys and particular data, not about whether a vendor's script appears on a page.

Questions to review in a pending matter

• Which CIPA provisions are asserted, and does any claim rest only on Section 638.51?
• Was the action filed before or after January 1, 2025?
• Which data is alleged to be routing or addressing information, and which is alleged to be contents?
• What was the consent sequence, and did tracking follow the visitor's choice?
• Does the complaint also assert federal, VPPA, or other state claims?

The CIPA evidence checklist covers preserving browser evidence for Section 631, 632, and 638.51 theories.

Common questions

Is SB 690 law?

Yes. Governor Newsom signed it on September 30, 2026. It becomes operative January 1, 2027.

Does SB 690 end CIPA website lawsuits?

No. It removes private pen register and trap-and-trace claims over website and app conduct against private actors. Private claims under Sections 631 and 632 remain, as do claims under other laws.

Does SB 690 apply to pending cases?

It applies to pending Section 638.51 claims in actions commenced within two years before January 1, 2027, which firm analyses read as filings on or after January 1, 2025. How it applies to a particular matter, including any challenge to retroactivity, is a question for counsel.

Does SB 690 create a commercial business purpose exception?

No. That language appeared in earlier drafts and was removed before the bill passed.

Sources and scope

This article summarizes SB 690 for defense-side review. It is not legal advice and does not predict how courts will apply the retroactivity provision. Primary sources are the enrolled SB 690 text, its legislative status, and California Penal Code 631, 632, 637.2, 638.50, and 638.51. Commentary cited above comes from Proskauer, Pillsbury, WilmerHale, Skadden, and Covington.